CVE-2023-51518

CRITICAL

Apache James <3.7.5, 3.8.0 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-51518. PoCs published by mbadanoiu.

AI-analyzed exploit summary This repository provides a writeup and references for CVE-2023-51518, a preauthenticated Java deserialization vulnerability in Apache James. It includes details on exploitation vectors and references to external resources for further technical details.

Description

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally. We recommend users to:  - Upgrade to a non-vulnerable Apache James version  - Run Apache James isolated from other processes (docker - dedicated virtual machine)  - If possible turn off JMX

Exploits (1)

nomisec WRITEUP 1 stars
by mbadanoiu · poc
https://github.com/mbadanoiu/CVE-2023-51518

This repository provides a writeup and references for CVE-2023-51518, a preauthenticated Java deserialization vulnerability in Apache James. It includes details on exploitation vectors and references to external resources for further technical details.

Classification
Writeup 90%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Theoretical
Target: Apache James < 3.7.5 and < 3.8.1
No auth needed
Prerequisites: Access to JMX interface · Deserialization gadget (e.g., ysoserial for Java <16)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Mailing List, Vendor Advisory vendor-advisory
https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or

Scores

CVSS v3 9.8
EPSS 0.0119
EPSS Percentile 63.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-502
Status published
Products (3)
apache/james 3.7.5
apache/james 3.8.0
org.apache.james/james-server 0 - 3.7.5Maven
Published Feb 27, 2024
Tracked Since Feb 18, 2026